The RunReveal Agent gets more intelligent

We've been building RunReveal's AI agent for a few months now; what started out as just an MCP server, then grew into an agent loop and chat, has now been improved with new features and new clients. We’ve added agent skills, dynamically loading tools, tool results recall, context compaction to support long running investigations, token monitoring and controls to tune your agent to ensure your agent spend is defensible and justifiable, and finally two new clients to interact with your agent: Slack and a terminal user interface via the runreveal CLI!

That’s a lot to ship in as many weeks, but how and why did we build it this way?

Introducing the RunReveal Agent In Slack

Chat and Slack are where most teams do their work today though, and after many requests for it, we decided to build an agent interface into Slack. Teams everywhere use Slack for collaboration (duh) and security teams often use Slack as the means to coordinate investigations. That’s why they need the agent in incident channels. Gone are the days where the incident team has to engage the data team to run some queries to understand the impact and scope of an attack, or whether or not there was an incident at all. Now, our customers can just ask @RunReveal.

Adding new agents wasn’t trivial when they share the same server-side session. We needed to re-work our backend agent loop to support multiple clients subscribing, broadcasting messages back to them and ensure we have proper concurrency management to prevent confusion when interacting with the client.

This matters because security investigations aren't solo work. Multiple analysts work the same incident. Someone starts triage at their desk, someone else picks it up from their phone during on-call. A local-only or single-client agent can't do that. A server-side one can, and it records everything along the way.

The Slack integration leans into how security teams already work. When an incident kicks off, you get a channel. The RunReveal bot joins with one interface: Talk to the agent. The Slack bot can query logs, build dashboards, and manage cases. No buttons, no slash-command menus, no widget soup. Just tell it what you need in plain language. The agent handles the rest through the same permission model as every other client, selected as granular permissions when authenticating using OAuth.

Agent Skills codify your incident runbooks

We also shipped skills, which are instruction sets you can load into the agent dynamically. We've written skills for dashboard creation, detection authoring, and log exploration. Teams can write their own, which turns runbooks from wiki pages rarely consulted when under pressure during a 2am incident into agent behavior that executes reliably and repeatably.

Compaction for long-running investigations

Initially, our investigations only fit into one context window. Security work is complex and many hypothesis often have to be tested to get to the bottom of something, so customers were often hitting the window, limiting the utility of the agent. In response, we built compaction that preserves the original intent of an investigation and favors recent context so the agent stays useful across sessions that run for hours. The chat history is always saved so nothing is lost, but the agent can continue making progress.

Token usage analytics

Then customers began to test it with investigations across massive amounts of data. But long investigations burn tokens, fast. The agent was suddenly able to piece together complex and disparate chains across dozens of data sources quickly, but also quickly burned through millions of tokens. o ensure that your CFO isn’t breathing down your neck in response, we built token usage analytics across inference providers and you get cost visibility without cutting sessions short, allowing you to see what automated triage alerts and investigations are really worth the squeeze, and which would be better suited for the more refined responder with a heartbeat.

AI SOC is all the rage right now and it’s hard to distinguish what’s real and what’s not. Tokenomics has many overfunded companies selling at a loss just to gain your business, only to turn around and jack up prices later. That is not the way. At RunReveal, we believe that AI is simply the future of software and not the product itself. Agentic features should be deeply integrated into your data stack to deliver the highest performance, reliability, value, and security.

If you want to learn more about what we’re building, and how we’re building it, come find RunReveal at Black Hat and DEF CON next week. If you’d like a demo to see how a vertically integrated security data platform can help resolve issues quicker and allow your team to refocus on the higher value work, make sure to reach out to our team to learn more.